feat: require a zero-error product typecheck and a test type-debt ratchet

Adds tsconfig.json (strict) over product code, fixes its remaining 90
diagnostics (type-only, interface corrections, and explicit narrowing),
and adds a typecheck job to the required free-tests aggregate running
bun run typecheck, the test-code ratchet (identity -> count baseline, fails
on new, repeated, or unlocked fixed diagnostics), and the lib/cso format
check. Reuses fixes from #2447 where they still applied.

lib/cso/preparation-container.ts

@@ -802,9 +802,10 @@ async function extractNpmArchive(
         fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL,
         0o600,
       );
-      current = { remaining: size, padding: (512 - (size % 512)) % 512, fd, mode: safeMode || 0o600 };
+      const mode = safeMode || 0o600;
+      current = { remaining: size, padding: (512 - (size % 512)) % 512, fd, mode };
       if (!size) {
-        fs.fchmodSync(fd, current.mode);
+        fs.fchmodSync(fd, mode);
         fs.closeSync(fd);
         current.fd = undefined;
         if (!current.padding) current = undefined;